GINC-APT-0923 · Tracked, unattributed

ScreamedJungle

Category
Tracked, unattributed · A vendor’s working cluster, not yet attributed.
Origin
Unknown
Sources
3 sources carry it
Identifier
GINC-APT-0923 · screamedjungle

What it is

ScreamedJungle is a threat actor that exploits vulnerabilities in outdated Magento e-commerce platforms to inject malicious JavaScript code, specifically Bablosoft JS, into compromised websites. This actor has harvested millions of browser fingerprints by leveraging vulnerabilities such as CVE-2024-34102 and CVE-2024-20720. ScreamedJungle utilizes PerfectCanvas technology to ensure pixel-perfect replication of legitimate user fingerprints. Group-IB analysts estimate that over 115 e-commerce sites have been impacted by this fingerprint theft campaign.

Tools

The tools and malware families the sources tie to it.

  • Agent.btz
  • Xploit

Sources

  • Malpedia malpedia.caad.fkie.fraunhofer.de